Hi, I'm
Chris Stahly
I hack shit(and listen to space trash)
Reverse engineer and application security specialist with 20+ years breaking, protecting, and understanding software. OSCP certified. Purdue CS.
P25 digital voice
Live APCO P25 Phase II decoding off a local HackRF. OP25 demods the digital voice, a Python web server handles talkgroup routing, audio archiving, and live streaming, with a web dashboard and iOS companion app on top.
- //Hardware · HackRF One · 8.8 cm V-dipole
- //Decoder · OP25 (GNU Radio-based P25 stack)
- //Server · Python, talkgroup routing, audio archive, live stream
- //Web app · Live activity feed at p25.sadbabyrabbit.com
- //iOS app · Native companion for browsing and playback
Aircraft, two stations, one map
Two ADS-B receivers. One in a in , one in . Both decode 1090 MHz Mode S off dump1090. Every marker is a position one of them is hearing right now, colored by which one caught it. Arrowheads point along the track.
▲ Destin 0·▲ Indiana 0·0 aircraft live
Marine traffic off the Gulf
A discone on the Florida coast hears every ship and boat in VHF range. AIS-catcher decodes both marine channels at once, plots them, and forwards the traffic to MarineTraffic and the other aggregators.
- //Hardware · Nooelec NESDR SmarTee v5 ·
- //Decoder · AIS-catcher, dual channel, 161.975 / 162.025 MHz
- //Feeds · MarineTraffic · VesselFinder · aiscatcher.org
- //Site · Destin, FL. Gulf coast, in a
Home mood engine
One full day, clockwise, starting where the engine starts its own. Each band is the color the lights were holding, and a thinner band is a dimmer one.
reading the engine
reading the house…
Quest 1 to postmarketOS
A first-generation Quest is a decent computer welded to an OS you do not control. The bootloader had just become unlockable, and the community Linux port existed but did not boot.
Snapdragon 835, dual 1440 by 1600 panels, four global-shutter cameras · 4.4.205. systemd will not boot on it, so OpenRC. · 19.5 to 72 per second. None of 1,200 intervals over 25 ms.
Warren
Say the phrase and audio streams to a server in the house, which transcribes it, asks a model and answers out loud. Nothing leaves the building. The same microphone feeds a listener that groups speech into conversations and writes each one up.
ESP32-S3 and a MEMS microphone on a 58 by 42 mm board of my own · Trained from scratch on synthesized speech. 62 KB. · Voice detection, Whisper, speaker embedding, grouped on a three-minute gap
Fathom
A Swift rewrite of Disk Inventory X, which has been unmaintained for years. Every file is a rectangle sized by how much room it takes.
838 GB, 9,142,686 files, 1,277,267 folders, 48.4 seconds · Bulk directory reads across eight workers. Eight is the measured sweet spot. · About 60 bytes a node, depth-first, in flat arrays
Play Lex, five by five
A whole game on a small board. Drag tiles out, or tap a tile and tap a square. First word covers the middle. Lex is the same opponent as the real game, reading the same dictionary.
loading the word list
Regexword
Every row and column is a pattern. Fill the grid so all of them match at once. The real ones are crossword grids, black squares and all.
0 of 16 filled
^[DFH][MOR][BEF][MNP]$^[ACI]+$^.[KLNO][ACD][PR]$^(.)[VXY]\1[BEFH]$^(CH|FI)(VF|SH)$^O[IK]L[YZ]$^[EH][AB]CH$^[PQ]I[PQ]E$Tap a square and type. A clue goes green when its line matches, red when it cannot.
The full gridsBuilds
Radios, reverse engineering, home automation, a word game. Source is linked where the repo is public.
Police and fire scanner
One radio follows both county trunked systems, transcribes every transmission, and groups them into incidents on a map.
- SDR
- OP25
- Whisper
Scanner for CarPlay
The native client for the scanner: the same incident map and live audio, on the dashboard screen.
- Swift
- CarPlay
Weather satellite capture
Predicts the pass, records it, decodes it, judges whether it came out, and publishes the good ones. It runs unattended.
- RTL-SDR
- LRPT
- Python
ORBCOMM fixes
These satellites broadcast their own GPS position. This is where they said they were.
- RTL-SDR
- 137 MHz
Aircraft, two stations
One receiver in Indiana, one in a weatherproof box on a Florida roof, on the same map.
- ADS-B
- 1090 MHz
Ships off the Gulf
A discone on the Florida coast hearing every vessel in VHF range, both AIS channels at once.
- AIS
- VHF
Quest 1 to postmarketOS
Putting Linux on a locked VR headset, then writing a stereo renderer, lens correction and head tracking from nothing.
- Reverse Engineering
- ARM64
- Linux
Wordrack
A crossword tile game with a computer opponent. No accounts, no install. Send someone the link.
- Game
- Node
Home mood engine
Lighting that follows the day. A color rotation runs continuously, and what is happening in the house bends it.
- Home Assistant
- Python
Warren
A wake-word speaker on a board I generated from a script, and a listener that groups the day's speech into conversations.
- ESP32-S3
- Whisper
- KiCad
Fathom
A Metal treemap of a whole volume that reconciles what it can see against what the system claims is used.
- Swift
- Metal
- macOS
Wardriving rig
A Pi that logs every Wi-Fi network and Bluetooth device it hears with a position, starts and stops on geography, and writes up each drive.
- Kismet
- BLE
- GPS
Latch
An iPhone panel for the house on the Camera Control button, which opens from the lock screen.
- Swift
- iOS
- ExtensionKit
About
A bit about me
I take software apart to see how it works, then either break it or make it harder to break. Mostly at the binary level.
Twenty years of it: binary analysis, crypto architecture, anti-tamper, anti-cheat, threat modeling, and running security engineering at the director level. The useful part of the job is usually working out what is actually at risk, which is rarely what anyone expected.
- ▸Reverse Engineering
- ▸Cryptography
- ▸Application Security
- ▸Threat Modeling
- ▸Binary Analysis
- ▸Anti-Tamper
- ▸Penetration Testing
- ▸OSCP
Work
Selected work
Mobile Application Protection
Anti-tamper and anti-reverse-engineering for banking, health and gaming apps. Binary instrumentation, runtime integrity checks, crypto obfuscation. It shipped on hundreds of millions of devices.
- Binary Analysis
- Anti-Tamper
- Cryptography
- iOS/Android
Medical Device Security Program
Built the security engineering program at a regulated medical device maker, starting from nothing: threat modeling, vulnerability assessment, code review, and a pen-test framework that reported numbers the executives could act on.
- Threat Modeling
- Penetration Testing
- Risk Assessment
- SDLC
Game Anti-Cheat & DRM
Anti-cheat and DRM for desktop and mobile games. Each protection plan was built from that game's own threat data: anti-debugging, license enforcement, integrity checks, and hiding the assets worth stealing.
- Anti-Cheat
- DRM
- Reverse Engineering
- Gaming